📄 mac-understandlabel.html
字号:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta name="generator" content="HTML Tidy, see www.w3.org" /><title>Understanding MAC Labels</title><meta name="GENERATOR" content="Modular DocBook HTML Stylesheet Version 1.7" /><link rel="HOME" title="FreeBSD Handbook" href="index.html" /><link rel="UP" title="Mandatory Access Control" href="mac.html" /><link rel="PREVIOUS" title="Explanation of MAC" href="mac-initial.html" /><link rel="NEXT" title="Module Configuration" href="mac-modules.html" /><link rel="STYLESHEET" type="text/css" href="docbook.css" /></head><body class="SECT1" bgcolor="#FFFFFF" text="#000000" link="#0000FF" vlink="#840084"alink="#0000FF"><div class="NAVHEADER"><table summary="Header navigation table" width="100%" border="0" cellpadding="0"cellspacing="0"><tr><th colspan="3" align="center">FreeBSD Handbook</th></tr><tr><td width="10%" align="left" valign="bottom"><a href="mac-initial.html"accesskey="P">Prev</a></td><td width="80%" align="center" valign="bottom">Chapter 15 Mandatory Access Control</td><td width="10%" align="right" valign="bottom"><a href="mac-modules.html"accesskey="N">Next</a></td></tr></table><hr align="LEFT" width="100%" /></div><div class="SECT1"><h1 class="SECT1"><a id="MAC-UNDERSTANDLABEL" name="MAC-UNDERSTANDLABEL">15.4Understanding MAC Labels</a></h1><p>A <acronym class="ACRONYM">MAC</acronym> label is a security attribute which may beapplied to subjects and objects throughout the system.</p><p>When setting a label, the user must be able to comprehend what it is, exactly, that isbeing done. The attributes available on an object depend on the policy loaded, and thatpolicies interpret their attributes in pretty different ways. If improperly configureddue to lack of comprehension, or the inability to understand the implications, the resultwill be the unexpected and perhaps, undesired, behavior of the system.</p><p>The security label on an object is used as a part of a security access controldecision by a policy. With some policies, the label by itself contains all informationnecessary to make a decision; in other models, the labels may be processed as part of alarger rule set, etc.</p><p>For instance, setting the label of <var class="LITERAL">biba/low</var> on a file willrepresent a label maintained by the Biba policy, with a value of ``low''.</p><p>A few policies which support the labeling feature in FreeBSD offers three specificpredefined labels. These are the low, high, and equal labels. Although they enforceaccess control in a different manner with each policy, you can be sure that the low labelwill be the lowest setting, the equal label will set the subject or object to be disabledor unaffected, and the high label will enforce the highest setting available in the Bibaand <acronym class="ACRONYM">MLS</acronym> policies.</p><p>Within single label file system environments, only one label may be used on objects.This will enforce one set of access permissions across the entire system and in manyenvironments may be all that is required. There are a few cases; however, where multiplelabels may be set on objects or subjects in the file system. For those cases, the <varclass="OPTION">multilabel</var> option may be passed to <ahref="http://www.FreeBSD.org/cgi/man.cgi?query=tunefs&sektion=8"><spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">tunefs</span>(8)</span></a>.</p><p>In the case of Biba and <acronym class="ACRONYM">MLS</acronym>, a numeric label may beset to indicate the precise level of hierarchical control. This numeric level is used topartition or sort information into different groups of say, classification onlypermitting access to that group or a higher group level.</p><p>In most cases the administrator will only be setting up a single label to usethroughout the file system.</p><p><span class="emphasis"><i class="EMPHASIS">Hey wait, this is similar to <acronymclass="ACRONYM">DAC</acronym>! I thought <acronym class="ACRONYM">MAC</acronym> gavecontrol strictly to the administrator.</i></span> That statement still holds true, tosome extent <tt class="USERNAME">root</tt> is the one in control and who configures thepolicy so that users are placed in the appropriate categories/access levels. Alas, manypolicies can restrict the <tt class="USERNAME">root</tt> user as well. Basic control overobjects will then be released to the group but <tt class="USERNAME">root</tt> may revokeor modify the settings at any time. This is the hierarchal/clearance model covered bypolicies such as Biba and <acronym class="ACRONYM">MLS</acronym>.</p><div class="SECT2"><h2 class="SECT2"><a id="AEN22090" name="AEN22090">15.4.1 Label Configuration</a></h2><p>Virtually all aspects of label policy configuration will be performed using the basesystem utilities. These commands provide a simple interface for object or subjectconfiguration or the manipulation and verification of the configuration.</p><p>All configuration may be done by use of the <ahref="http://www.FreeBSD.org/cgi/man.cgi?query=setfmac&sektion=8"><spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">setfmac</span>(8)</span></a> and <ahref="http://www.FreeBSD.org/cgi/man.cgi?query=setpmac&sektion=8"><spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">setpmac</span>(8)</span></a> utilities.The <tt class="COMMAND">setfmac</tt> command is used to set <acronymclass="ACRONYM">MAC</acronym> labels on system objects while the <ttclass="COMMAND">setpmac</tt> command is used to set the labels on system subjects.Observe:</p><pre class="SCREEN"><samp class="PROMPT">#</samp> <kbd class="USERINPUT">setfmac biba/high test</kbd></pre><p>If no errors occurred with the command above, a prompt will be returned. The only timethese commands are not quiescent is when an error occurred; similarly to the <ahref="http://www.FreeBSD.org/cgi/man.cgi?query=chmod&sektion=1"><spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">chmod</span>(1)</span></a> and <ahref="http://www.FreeBSD.org/cgi/man.cgi?query=chown&sektion=8"><spanclass="CITEREFENTRY"><span class="REFENTRYTITLE">chown</span>(8)</span></a> commands. Insome cases this error may be a ``<tt class="ERRORNAME">Permission denied</tt>'' and isusually obtained when the label is being set or modified on an object which isrestricted.<a id="AEN22114" name="AEN22114" href="#FTN.AEN22114"><spanclass="footnote">[1]</span></a> The system administrator may use the following commandsto overcome this:</p><pre class="SCREEN"><samp class="PROMPT">#</samp> <kbd class="USERINPUT">setfmac biba/high test</kbd>``<tt class="ERRORNAME">Permission denied</tt>''<samp class="PROMPT">#</samp> <kbdclass="USERINPUT">setpmac biba/low setfmac biba/high test</kbd><samp class="PROMPT">#</samp> <kbd class="USERINPUT">getfmac test</kbd>test: biba/high</pre><p>As we see above, <tt class="COMMAND">setpmac</tt> can be used to override the policy'ssettings by assigning a different label to the invoked process. The <ttclass="COMMAND">getpmac</tt> utility is usually used with currently running processes,such as <b class="APPLICATION">sendmail</b>: although it takes a process ID in place of acommand the logic is extremely similar. If users attempt to manipulate a file not intheir access, subject to the rules of the loaded policies, the ``<ttclass="ERRORNAME">Operation not permitted</tt>'' error will be displayed by the <codeclass="FUNCTION">mac_set_link</code> function.</p><div class="SECT3"><h3 class="SECT3"><a id="AEN22130" name="AEN22130">15.4.1.1 Users and LabelSettings</a></h3><p>Users themselves are required to have labels so that their files and processes mayproperly interact with the security policy defined on the system. This is configuredthrough the <tt class="FILENAME">login.conf</tt> file by use of login classes. Everypolicy that uses labels will implement the user class setting.</p><p>An example entry containing every policy is listed below:</p><pre class="PROGRAMLISTING">default:\ :copyright=/etc/COPYRIGHT:\ :welcome=/etc/motd:\ :setenv=MAIL=/var/mail/$,BLOCKSIZE=K:\ :path=~/bin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:\ :manpath=/usr/share/man /usr/local/man:\ :nologin=/usr/sbin/nologin:\ :cputime=1h30m:\ :datasize=8M:\ :vmemoryuse=100M:\ :stacksize=2M:\ :memorylocked=4M:\ :memoryuse=8M:\ :filesize=8M:\ :coredumpsize=8M:\ :openfiles=24:\ :maxproc=32:\ :priority=0:\ :requirehome:\ :passwordtime=91d:\ :umask=022:\ :ignoretime@:\ :label=partition/13,mls/5,biba/10(5-15),lomac10[2]:</pre><p>The <var class="LITERAL">label</var> option is used to set the user class defaultlabel which will be enforced by <acronym class="ACRONYM">MAC</acronym>. Users will neverbe permitted to modify this value, thus it can be considered not optional in the usercase. In a real configuration, however, the administrator will never wish to enable everypolicy. It is recommended that the rest of this chapter be reviewed before any of thisconfiguration is implemented.</p><div class="NOTE"><blockquote class="NOTE"><p><b>Note:</b> Users may change their label after the initial login; however, thischange is subject constraints of the policy. The example above tells the Biba policy thata process's minimum integrity is 5, its maximum is 15, but the default effective label is10. The process will run at 10 until it chooses to change label, perhaps due to the userusing the setpmac command, which will be constrained by Biba to the range set atlogin.</p></blockquote></div><p>In all cases, after a change to <tt class="FILENAME">login.conf</tt>, the login classcapability database must be rebuilt using <tt class="COMMAND">cap_mkdb</tt> and this willbe reflected throughout every forthcoming example or discussion.</p><p>It is useful to note that many sites may have a particularly large number of usersrequiring several different user classes. In depth planning is required as this may getextremely difficult to manage.</p><p>Future versions of FreeBSD will include a new way to deal with mapping users tolabels; however, this will not be available until some time after FreeBSD 5.3.</p></div><div class="SECT3"><h3 class="SECT3"><a id="AEN22146" name="AEN22146">15.4.1.2 Network Interfaces and LabelSettings</a></h3><p>Labels may also be set on network interfaces to help control the flow of data acrossthe network. In all cases they function in the same way the policies function withrespect to objects. Users at high settings in <var class="LITERAL">biba</var>, forexample, will not be permitted to access network interfaces with a label of low.</p><p>The <var class="OPTION">maclabel</var> may be passed to <ttclass="COMMAND">ifconfig</tt> when setting the <acronym class="ACRONYM">MAC</acronym>label on network interfaces. For example:</p><pre class="SCREEN"><samp class="PROMPT">#</samp> <kbdclass="USERINPUT">ifconfig bge0 maclabel biba/equal</kbd></pre><p>will set the <acronym class="ACRONYM">MAC</acronym> label of <var⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -